syzbot


WARNING in ieee80211_get_sband

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+7716dbc401d9a437890d@syzkaller.appspotmail.com
Fix commit: 0ee4d55534f8 mac80211: remove warning in ieee80211_get_sband()
First crash: 850d, last: 621d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: C syz .config

Sample crash report:
device wlan0 entered promiscuous mode
------------[ cut here ]------------
WARNING: CPU: 1 PID: 8457 at net/mac80211/ieee80211_i.h:1457 ieee80211_get_sband+0x2e3/0x3e0 net/mac80211/ieee80211_i.h:1457
Modules linked in:
CPU: 0 PID: 8457 Comm: syz-executor424 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ieee80211_get_sband+0x2e3/0x3e0 net/mac80211/ieee80211_i.h:1457
Code: f9 48 c7 c2 c0 d5 62 8a be 89 02 00 00 48 c7 c7 20 d6 62 8a c6 05 08 fa 38 05 01 e8 d9 4d 64 00 e9 b8 fd ff ff e8 fd 35 1c f9 <0f> 0b e8 36 e5 a4 00 31 ff 89 c3 89 c6 e8 0b 3c 1c f9 85 db 74 19
RSP: 0018:ffffc900011573d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff888027792380 RSI: ffffffff8856a0d3 RDI: 0000000000000003
RBP: ffff88801cc60c80 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8856a055 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88801cce0bc0 R14: ffff88801cc60c80 R15: ffffc9000115751c
FS:  00007fdbcf917700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f88c258b380 CR3: 000000001a8db000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sta_apply_parameters+0x4e/0x1dc0 net/mac80211/cfg.c:1454
 ieee80211_add_station+0x320/0x660 net/mac80211/cfg.c:1681
 rdev_add_station net/wireless/rdev-ops.h:190 [inline]
 nl80211_new_station+0xdd0/0x13c0 net/wireless/nl80211.c:6650
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4459a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdbcf9172f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004cb470 RCX: 00000000004459a9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 000000000000000a
RBP: 00000000004cb47c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049af88
R13: 0031313230386c6e R14: 1102080006000a00 R15: 00000000004cb478

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-selinux-root 2021/05/26 01:49 upstream ad9f25d33860 2bd9619f .config console log report syz C
ci-upstream-kasan-gce-selinux-root 2021/04/26 01:27 upstream 9f4ad9e425a1 2bd9619f .config console log report syz C
ci-upstream-kasan-gce-selinux-root 2021/03/12 02:33 upstream f78d76e72a46 2bd9619f .config console log report syz C
ci-upstream-kasan-gce-386 2021/01/22 12:20 upstream 83d09ad4b950 0d27f508 .config console log report syz C
ci-upstream-kasan-gce-386 2020/12/23 08:27 upstream 614cb5894306 0d27f508 .config console log report syz C
ci-upstream-net-this-kasan-gce 2020/11/10 21:08 net 989ef49bdf10 4a77ae0b .config console log report syz C
* Struck through repros no longer work on HEAD.
Crashes (7):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-selinux-root 2021/02/09 20:35 upstream e0756cfc7d7c 2bd9619f .config console log report syz C WARNING in ieee80211_get_sband
ci-upstream-kasan-gce-smack-root 2021/02/07 05:47 upstream 964d069f93c4 0655e081 .config console log report syz C WARNING in ieee80211_get_sband
ci-upstream-kasan-gce-root 2021/01/28 11:05 upstream 76c057c84d28 eefc07f2 .config console log report syz C WARNING in ieee80211_get_sband
ci-upstream-linux-next-kasan-gce-root 2021/03/27 01:05 linux-next 931294922e65 a8529b82 .config console log report syz C WARNING in ieee80211_get_sband
ci-upstream-kasan-gce-386 2020/11/23 04:04 upstream a349e4c65960 0d27f508 .config console log report syz C
ci-upstream-net-this-kasan-gce 2020/10/11 20:52 net 874fb9e2ca94 4a77ae0b .config console log report syz C
ci-upstream-net-kasan-gce 2020/10/09 19:25 net-next 036dfd8322be d81b165e .config console log report syz C
* Struck through repros no longer work on HEAD.